Internal audIt requIrements and saP® solutIonsSupport for the Internal audIt BuSIneSS proceSS

SAP Thought Leadership

Software has enabled internal audit functions to be more efficient and effective, and improving function ality and value will bring even greater benefits. Sap software solutions address the more significant tech nology needs of the internal audit function. the solutions enable the planning, man agement, and execution of internal audit projects; enter prise risk management; data mining and analytics; and automated testing.

4 Executive Summary

5 The Internal Audit Function’s Use of Software

6 risk assessment and develop­ment of the overall audit plan

7 engagement planning 8 performance of the engagement 8 Working papers and audit

documentation 8 data analytics and automated

testing of controls and data 9 continuous control and data

auditing 9 the use and Value of technology

for audit projects 10 communicating the results of the

engagement 10 department administration 10 Managing resources 10 Monitoring actions 11 reporting progress against plan 11 performing Quality assurance 11 the next evolution of Internal

audit 12 the Value provided by Software

13 SAP Solutions for Internal Auditors

13 audit Management functionality in Sap netWeaver

13 Sap Businessobjects risk Management

14 Sap Businessobjects access control

14 Sap Businessobjects process control

14 additional automated controls 14 automated testing of controls 14 other considerations 15 Sap Businessobjects BI

Solutions 16 Solution combinations 17 for More Information

Content

About the Author

norman Marks was the leader of internal audit functions at u.S. and global cor porations for more than 15 years. In that capacity, he at times functioned as the chief ethics and compliance officer and as the chief risk officer.

he is a recognized international leader in the theory and practice of internal auditing and was profiled by magazines of the american Institute of certified public accountants and the Institute of Internal auditors (IIa).

Marks authored some of IIa’s most downloaded publications, including Sarbanes­oxley §404: a Guide for Management by Internal controls practitioners and Guide to the assessment of It General controls Scope based on risk (known as the GaIt methodology).

4 SAP Thought Leadership – Internal audit requirements and Sap Solutions

the internal audit function has a key role in any organization’s governance, risk, and compliance (Grc) operations. the Institute of Internal auditors’ (IIa) definition of internal auditing states the fundamental purpose, nature, and scope of internal auditing: “Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization’s operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes.”1

Internal audit adds value by providing board and management stakeholders with assurance that Grc processes are effective, while identifying areas where there are opportunities for improve ment. this assurance, or peace of mind, enables the stakeholders to “sleep during the storm,” knowing they can rely on management’s Grc processes.

Software has enabled internal audit functions to be more efficient and effec­tive, and improving functionality and value will bring even greater benefits in the future. Sap® software solutions address the more significant technology needs of the internal audit function.

Specifically, the solutions enable:• planning, management, and execu tion

of internal audit projects• enterprise risk management pro­

cesses in which internal audit risk assessment is integrated

• data mining and analytics• automated testing, including the

documentation of results and the monitoring of related action items, with particular strength in the area of continuous monitoring and auditing of risks and controls

In this paper we discuss how internal audit functions use software, where software provides the most value, and the functionality included in Sap applications to meet internal auditors’ most pressing needs.

the Sap applications that are particu­larly relevant are:• Sap Businessobjects™ risk

Management• Sap Businessobjects access control• Sap Businessobjects process

control• Sap Businessobjects business

intelligence solutions• audit management functionality in the

Sap netWeaver® technology platform

exeCutIve summaryMakInG Internal audIt functIonS More effIcIent and effectIVe

1. Source: Institute of Internal auditors’ definition at www.theiia.org/guidance/standards­and­guidance/ippf/definition­of­internal­auditing.

5SAP Thought Leadership – Internal audit requirements and Sap Solutions

• Communicating the results of the engagement Standard 2410 explains the criteria for effective communications: “communications must include the engagement’s objectives and scope as well as applicable conclusions, recommendations, and action plans.”5

• Department administration, which includes:– Managing resources such as

budget, headcount, and staff development

– Monitoring the actions taken by management in response to issues identified in internal audit reports

– reporting progress against plan to the board and executive manage­ment, and the general effective ness of the internal audit function

– performing quality assurance

a growing number of internal audit departments have implemented a form of continuous auditing. We believe there is significantly more value in a contin u ous risk and controls assur ance approach than in testing of controls alone.6 furthermore, the replacement over time of traditional audit projects with a more continuous form of assess­ment and testing changes the audit lifecycle. however, the great majority of internal audit departments are using a more traditional, project­based, internal audit plan. how Sap® products meet both project­based and continuous auditing needs is discussed in this paper.

to understand internal audit’s use of technology, it is important to review how a typical internal audit department operates. While each department may have a different methodology (or audit lifecycle) that is a variation on this theme, a typical internal audit depart­ment performs the following activities:

• Risk assessment and development of the overall audit plan– Standard 2010 on planning in

the Standards published by the Institute of Internal auditors (IIa) states: “the chief audit executive must establish risk­based plans to determine the priorities of the internal audit activity, consistent with the organization’s goals.”2

– Standard 2010 also provides this interpretation: “the chief audit executive is responsible for devel­oping a risk­based plan. the chief audit executive takes into account the organization’s risk management framework, including using risk appetite levels set by management for the different activities or parts of the organization. If a framework does not exist, the chief audit exe­cutive uses his/her own judgment of risks after consultation with senior management and the board.”

• Engagement planning Standard 2200 guides as follows: “Internal auditors must develop and document a plan for each engage­ment, including the engagement’s objectives, scope, timing, and resource allocations.”3

• Performance of the engagement Standard 2300 applies: “Internal auditors must identify, analyze, evalu­ate, and document sufficient informa­tion to achieve the engagement’s objectives.”4

2. International Standards for the professional practice of Internal auditing [Standards], the Institute of Internal auditors, october 2008.3. Ibid.4. Ibid.5. Ibid.6. In fact, we believe it is the way of the future for internal audit. for more information, see a look into the future: the next evolution of Internal audit, Sap aG, april 2004. It is available at www.sap.com/solutions/sapbusinessobjects/large/governance­risk­compliance/brochures.

the Internal audIt FunCtIon’s use oF soFtwareaddreSSInG the technoloGy needS of the audIt lIfecycle

6 SAP Thought Leadership – Internal audit requirements and Sap Solutions

Risk Assessment and Develop­ment of the Overall Audit Plan

Most internal audit departments devel­op at least an annual plan following an assessment of the risks facing the orga nization. leading companies have more frequent updates to their plans, to ensure their activities remain focused on the organization’s more significant risks.7

the interpretation of Standard 2010 states, “the chief audit executive takes into account the organization’s risk man­agement framework, including using risk appetite levels set by management for the different activities or parts of the organization.”8

the value for the practitioner is greatest when the internal audit risk assessment is derived from the enterprise risk man­

agement process. there is no need for internal audit to perform a redundant risk assessment when it can use the enter­prise assessment. the argument that management’s risk assessment process is not acceptable is overcome when internal audit works with manage ment to bring it up to acceptable levels – as required by IIa Standard 2120: “the internal audit activity must evalu ate the effectiveness and contribute to the improvement of risk management processes.”9

the Sap Businessobjects™ risk Management application enables an organization to develop and maintain an enterprise­wide risk management pro­gram. the enterprise assessment of risks can then be used by the internal audit function to select which risks will be addressed in the audit plan. audit management functionality in the Sap

netWeaver® technology platform can be used to manage the internal audit plan.

for example, the internal audit depart­ment at company aBZ has a risk­based audit approach. the internal audit depart ment identifies the more signifi­cant risks facing the company from management’s risk assessment pro gram and builds the audit plan to address these risks. Internal audit selects the risks from Sap Businessobjects risk Management and builds the audit plan using audit management functionality in Sap netWeaver.

there are a number of ways that indi­vidual audit projects can be linked back to organizational risks. one option is to structure the hierarchy of the audit plan so that the projects are organized by risk area. another is to take advan­tage of the customization features in audit management functionality in Sap netWeaver. each audit can be assigned an audit type, such as It, operational, or compliance, which identifies the enter­prise risk areas the audit addresses. perhaps the simplest is the approach taken by aBZ: the first step in the audit program is to identify the scope and objectives of the audit. this includes defining the enterprise risks to be addressed.

7. escalating the role of internal audit, ernst & young’s 2008 Global Internal audit Survey, reports, “leading companies periodically refresh their risk as­sessments and update the internal audit plan throughout the year to address the impact an ever­changing business environment has on the risk profile of the organization.”

8. op cit, International Standards for the professional practice of Internal auditing.9. Ibid.

7SAP Thought Leadership – Internal audit requirements and Sap Solutions

a large number of internal audit depart­ments use surveys of management and others to assess risks when manage­ment does not have a risk management program, using the terms control self­assessment (cSa) or, more accurately, risk self­assessment (rSa). risk man agement and monitoring in general are enabled by Sap Businessobjects risk Management, while the Sap Businessobjects process control application has preconfigured workflow specifically for surveys.

Some audit functions use data analytics and data mining to obtain information as part of their risk assessment pro cess. this is fully supported by our business intelligence products. for example, the internal audit department at aBZ uses Sap Businessobjects business intelli­gence (BI) solutions to analyze inven­tory trends. audits are scheduled at locations where inventory is expected to grow and where audits have not been performed within the last year.

If the internal audit department uses the continuous auditing techniques supported by Sap Businessobjects process control, then it can take advan­tage of the integration between Sap Businessobjects risk Manage ment and Sap Businessobjects pro cess control. risks are identified first in Sap Businessobjects risk Management, together with the related controls. those same risks and controls are then shared with Sap Businessobjects process control, where the testing is performed.

In summary, the risk assessment and development of the audit plan are sup­ported by the following Sap products:• SAP BusinessObjects Risk

Management provides the required risk assessment functionality, including support for cSa and rSa surveys.

• SAP BusinessObjects BI solutions enable highly effective data mining and data analytics to support the internal audit risk assessment process.

• Audit management functionality in SAP NetWeaver enables internal audit departments to plan, manage, staff, and perform internal audit projects.

Engagement Planning

engagement planning is not typically a technology­intensive activity. as Standard 2200 states,10 it includes determination of the “objectives, scope, timing, and resource allocations” for the project.

When a project is included in the audit plan, an initial determination of objec­tives, scope, and resource require ments is made based on the current assess­ment of risk. this is updated when it is time to prepare for the actual engage­ment, perhaps a month before the work starts.

clearly, using the enterprise risk man­agement process to update the initial risk assessment or to develop more detail is of value. however, this may not be as current or as detailed as required for planning the scope of individual audit projects.

as a result, engagement planning is typically completed through a combi­nation of interviews with management, reviews of management reports (such as financial and operational results), data analytics (or data mining), surveys, and discussions within the internal audit department. data analytics and sur veys are the only areas likely to be enabled through the intelligent use of technology.11

effective data mining can help the audi­tor understand the operations of the area to be audited and set an appro ­priate set of objectives and a project scope. for example, a retail chain could assess revenue and margin perfor­mance and trends, inventory levels, and headcount levels at a targeted store and compare them with systemwide averages.

Sap Businessobjects BI solutions, one of the leading product offerings for data analytics, provide internal audit depart ments the functionality to perform effective and efficient data mining to support all phases of the audit, includ ing engagement planning.

10. op cit, International Standards for the professional practice of Internal auditing.11. In escalating the role of internal audit, ernst & young’s 2008 Global Internal audit Survey, ernst & young comment that “leading internal audit functions

use data analytics for numerous activities, including risk assessment, planning, execution, and reporting.” however, they estimate only 38% of entities currently use them for audit planning.

8 SAP Thought Leadership – Internal audit requirements and Sap Solutions

you can perform surveys using the func­tionality in either Sap Businessobjects process control or Sap Businessobjects risk Management. you can download the results in adobe pdf format and upload as a working paper into audit management func tion­ality in Sap netWeaver.

If you manage or perform compliance testing on internal controls over finan cial reporting, Sap Businessobjects pro­cess control can assist with func tion­ality for scoping the work to be performed.

Performance of the Engagement

the extent that technology is used in performing audit projects varies signifi­cantly from project to project, organiza­tion to organization, and industry to industry.

Working papers and audit documentationall projects include working papers and audit documentation.12 however, the level and quality of documentation pre­pared and retained varies significantly by internal audit staff size; the need for remote work­paper review; who reviews the audit documentation (external audit firm, regulators, and others); the type of project (such as an investigation, com­pliance review, Sarbanes­oxley controls testing, or operational efficiency review); and the preference of the head of the

internal auditing function. IIa Standard 2330 is concise,13 requiring only that “internal auditors must document rele­vant information to support the conclu­sions and engagement results.”

only some projects involve the prepa­ration or maintenance by the auditor of process and system flowcharts or narra­tives. for example, many compliance or operational audits often do not.

the preference at some organizations is to reference, but not retain, copies of management documents used during the audit (such as documents tested, policies and procedures, and organiza­tion charts), but others prefer to store the version of the documents examined during the audit.

Work programs and the results of test ­ing (including deficiency workflow) may be retained within the software used for that purpose; for example, in Sap Businessobjects process control or in audit manage ment functionality in Sap

netWeaver. deficiency management – including documentation of the issue, assessment, review, and remediation – is supported at the con trol level in Sap Businessobjects pro cess control, at the risk level in Sap Businessobjects risk Manage ment, and by audit man age­ment functionality in Sap netWeaver.

Where Sap Businessobjects process control is used to perform a test, the results can be downloaded in adobe pdf format and uploaded into Sap netWeaver. alternatively, the docu men­tation in audit management functionality in Sap netWeaver may simply refer­ence the testing in Sap Businessobjects process control.

data analytics and automated testing of controls and datatesting of controls and data may be manual, automated, or a combination of the two. the use of data analytics, including computer­assisted audit tech­niques (caats), varies significantly. While most audits use some form of

Sap Businessobjects BI solutions, one of the lead ing product offerings for data analytics, provide internal audit departments the functionality to perform effec­tive and efficient data mining to support all phases of the audit, including engagement planning.

12. a few companies do not develop working papers for routine audits. this is because they do not see the value. however, this is a rare practice.13. op cit, International Standards for the professional practice of Internal auditing.

9SAP Thought Leadership – Internal audit requirements and Sap Solutions

data analytics,14 auditors are typically using existing reports and analyses generated for and provided by manage­ment. as a whole, most audit engage­ments do not use data analytics devel­oped specifically for the audit; however, certain types of engagement, such as forensic fraud investigations,15 and cer­tain industries, such as financial services, use them relatively extensively.

Sap provides solutions for data analyt­ics and automated testing for internal auditors. these include functionality in Sap Businessobjects process control and Sap Businessobjects BI solutions. auditors can define testing as a step in their audit program and then execute the test using either Sap Businessobjects BI solutions or Sap Businessobjects

process control. the results can be downloaded to adobe pdfs and uploaded as audit documentation in audit management functionality in Sap netWeaver.

continuous control and data auditingcertain It engagements, such as those in the network security area, may use specialized tools for vulnerability assess ment. a number of Sap part­ners pro vide add­on functionality that can be used by internal auditors in these tech nical areas.

a growing number of organi za tions employ at least a degree of con tin uous auditing.16 however, few organizations have deployed con tin uous auditing for more than a few, higher­risk areas.

the use and Value of technology for audit projectsWe believe internal auditors can benefit significantly through the use of soft ware for many engagements, but the value varies significantly. electronic working papers are valuable for larger audit departments, especially where there is a need for reviews by managers in another location. Sap Businessobjects process control has working­paper functionality for automated and manual testing performed using that applica tion. audit management functionality in Sap netWeaver also has automated working­paper functionality.

flowcharting software is valuable, and there are excellent stand­alone prod ­ucts for that functionality. flow charts devel oped in a stand­alone product like Microsoft Visio can be uploaded into Sap netWeaver and Sap Businessobjects process con trol. the value of integrating the function­ality into a Grc solution is unclear. the value of automated testing, especially using continuous control and data auditing, is high and continues to grow. It enables broader and deeper analysis of actual controls performance and data integrity. Sap has excellent func tion al­ity in its Sap Businessobjects pro cess control, Sap Businessobjects access control, and Sap Businessobjects BI solutions.

14. 78%, according to escalating the role of internal audit, ernst & young’s 2008 Global Internal audit Survey.15. In escalating the role of internal audit, ernst & young’s 2008 Global Internal audit Survey, ernst & young estimate use of data analytics software for

fraud detection programs at 38%. however, usage for actual investigations is higher.16. In escalating the role of internal audit, ernst & young’s 2008 Global Internal audit Survey, ernst & young estimate that 42% of entities have a continuous

auditing program and about half of the 58% that currently do not have such a program do have plans to implement the technology in the future.

10 SAP Thought Leadership – Internal audit requirements and Sap Solutions

it is important to ensure the audit report is balanced and fair in its overall message. this takes careful crafting and the attention of audit management. Individual control test failures are facts, but best practice is for the auditor to collect all the facts, understand the root causes, and develop a report to man age­ment that clearly and fairly commu ni­cates the situation and stimulates appro­priate remediation. this is a process

that requires judgment and not the simple repetition in the audit report of individual control exceptions.

an exception is where internal audit departments have taken the continuous risk and control assurance approach, as recommended in a look into the future: the next evolution of Internal audit.17 In this operating model, internal audit monitors the health of the more significant risks and the related controls on a continuous basis. reporting the results of that continuous work requires

a more continuous communications model than traditional audit reports. Solutions such as dashboards and alerts (when there are potential excep tions) may be highly effective.

Department Administration

this category includes internal audit department activities that are not related directly to risk assessment and planning or to individual audit projects.

Managing resourcesas with any department, internal audit needs to manage its budget (primarily personnel and related costs) and train and develop staff. these needs are not unique to internal audit, do not need to be integrated with other functionality (with rare exceptions, primarily for those few internal audit departments that track hours so they can bill for their ser vices), and can be met by more general ized products. for example, an organiza tion’s performance manage ment software can be used for budgeting, and hr software can be used to keep track of staff skills and experiences.

Monitoring actionsan important task for most internal audit departments (in a few cases, manage­ment is responsible for this activity) is monitoring the actions management takes in response to issues identified in internal audit reports. certainly, soft­ware is a valuable enabler – especially for larger organizations or where there are a large number of actions to track.

Communicating the Results of the Engagement

Working­paper technology may be used as issues are identified during the audit and provide workflow to obtain related management responses and action items. as mentioned earlier, issue management is supported by Sap Businessobjects risk Management, Sap Businessobjects process con trol,

and by audit management function ality in Sap netWeaver. that informa tion may be incorporated into reporting to management, but the actual reports are invariably produced in Microsoft Word or Microsoft powerpoint form (and may be transmitted through e­mail).

few internal audit departments generate their reports to management automatically. the reason is that while certain sections of the report (such as the scope and objectives) may be popu­lated from audit management software,

17. op cit, available at www.sap.com/solutions/sapbusinessobjects/large/governance­risk­compliance/brochures..

While internal auditors are exploring the potential for continuous auditing, few have made significant progress in totally replacing traditional auditing methods. for the next few years at least, customers will use a combination of traditional auditing methods, which are supported by audit management functionality in Sap netWeaver, and continuous auditing and monitoring supported by Sap Businessobjects process control.

11SAP Thought Leadership – Internal audit requirements and Sap Solutions

Better products include workflow, where management is reminded of the required actions and provided updates on pro­gress made.

We believe that when internal audit iden tifies deficiencies requiring man­age ment actions, the related enterprise risk status should be updated. Sap Businessobjects risk Management includes this functionality and is used to track the status of corrective actions. In addition, Sap Businessobjects process control and audit management functionality in Sap netWeaver can be used to track actions taken in response to individual tests.

reporting progress against plantypically, internal audit provides quarterly and annual reports to the board (or audit committee of the board) and executive management, including summaries of progress against plan and key issues. While some of the details may be derived

from audit management software, it would be unusual for the report to be generated automatically. Most organi za ­tions use either Microsoft powerpoint or Microsoft Word to develop a report (typically presented at an audit com­mittee meeting) to meet the needs of these key stakeholders. Most internal audit departments would find value in the enhanced reporting functionality of Sap crystal presentation design software.

performing Quality assuranceevery internal audit function is required to implement a process to provide supervision and, in general, ensure the quality of its products and services. technology can assist, for example by enabling remote working­paper review and electronic evidence of review. Sap Businessobjects process control and audit management functionality in Sap netWeaver include the ability to docu­ment testing and working­paper review.

The Next Evolution of Internal Audit

We believe the not­too­distant future for internal auditing includes a technology­driven revolution that will enable a dramatic and necessary change in the way internal auditors operate. for example, the internal auditing function will be able to provide almost continu­ous assurance that risks of significance are managed effectively and related con­trols are performing as desired across the organization. traditional assurance projects will largely be replaced by a combination of continuous auditing/monitoring and rapid­response audits of risk hot spots. resources will be freed up for process improvement and other consulting oppor tunities. We also believe that not only are many of the seeds of that change already in the ground, but their fruit is ready to be harvested for use today.

this vision is described in detail in our paper a look into the future: the next evolution of Internal audit.18 organizations that have evolved to a continuous assurance model will benefit from the following software:• enterprise strategy and risk

management• continuous risk monitoring• continuous control and data auditing,

including both automated testing and the use of business intelligence, such as a data warehouse

• automated alert and workflow to close the loop when monitoring detects issues

• dashboards and other tools for continuous reporting

18. Ibid.

12 SAP Thought Leadership – Internal audit requirements and Sap Solutions

each of these is an area of strength for Sap Businessobjects software, but it is important to recognize the current state of the market.

the traditional internal audit approach is based on an annual plan, which may be updated during the year, with a num ber of individual audit projects. Increas ingly, internal auditors are turning to continuous auditing and continuous monitoring (in theory, monitoring is performed by management, but many auditors are developing the monitoring program with the intent to turn it over at a later date to management). Sap Businessobjects process control is an excellent solution for both continuous auditing and continuous monitoring, especially when supplemented by Sap

Businessobjects access control for the monitoring of systems access controls, and Sap Businessobjects BI solutions for complex data analysis.

While internal auditors globally are exploring the potential for continuous auditing, few have made significant progress in totally replacing traditional auditing methods. the great majority have a desire to start but are doing so slowly and carefully – the appropriate approach. for the next few years at least, customers will use a combination of traditional auditing methods (which are supported by audit management functionality in Sap netWeaver) and continuous auditing and monitoring (supported by Sap Businessobjects process control).

The Value Provided by Software

there are a number of areas where internal audit functions obtain value from software. the functionality with the greatest value includes:• data mining and analytics• automated testing, especially as

part of a continuous risk and control assurance program

• risk assessment and risk monitoring that is integrated with the enterprise risk management process

• planning and management of individual audit projects

• tracking and following up on control deficiencies

Sap products include market­leading solutions for each of the above needs.

In the same way that operating management can use Sap Businessobjects BI solutions to transform mountains of data into actionable intelligence, internal auditors can sift through that data to understand and monitor risks and to identify potential control issues or inappropriate activities.

13SAP Thought Leadership – Internal audit requirements and Sap Solutions

In addition to the standard functionality in Sap Business Suite software and Sap Businessobjects enterprise per­for mance management solutions (for example, auditors use reports from budget and consolidations applica tions), internal auditors can obtain value from:• audit management functionality in

Sap netWeaver • Sap Businessobjects risk

Management• Sap Businessobjects access control• Sap Businessobjects process

control• Sap Businessobjects BI solutions

the following sections cover each individually and in combination.

Audit Management Functionality in SAP NetWeaver

Internal and other auditors can use the functionality in Sap netWeaver to:• Build the annual (or other period)

audit plan. the plan can be organized in a variety of ways, depending on customer preference. for example, it can be structured by geography; division or organizational structure; type of audit; or risk area covered. the plan lists the individual audit projects to be performed.

• Build and maintain the audit program for an individual audit project. each audit consists of a number of activi­

ties organized into an audit program that is maintained in audit manage­ment functionality in Sap netWeaver.

• Staff the audit and assign tasks• perform the audit, identify and route

deficiencies for action, and maintain working papers

• Summarize the results for inclusion in the audit report

SAP BusinessObjects Risk Management

this product supports the enterprise risk management program. Internal auditors can use it to:• Identify the more significant risks to

the business and determine which will be addressed in audit projects

• Monitor risks to help ensure that the audit plan remains current and to understand changes in the risk environment

• Monitor the status of management’s responses to risks that exceed organizational tolerances

• perform risk assessment surveys using the survey function in the product

Increasingly, internal auditors are assess ing the adequacy of the orga­nization’s risk management of signifi­cant risks. Sap Businessobjects risk Management can be a core element in a robust risk management program.

saP solutIons For Internal audItorscoMBInInG productS for autoMated control and enhanced Value

14 SAP Thought Leadership – Internal audit requirements and Sap Solutions

SAP BusinessObjects Access Control

this product is used by management to manage system access, avoid granting incorrect or unwarranted privileges, and address segregation of duties issues. Internal auditors can use it to:• Monitor and audit management’s

provisioning process• run reports to confirm if access is

appropriate• Be notified when access exceptions

are identified by monitoring

SAP BusinessObjects Process Control

Sap Businessobjects process control can be used by an organization in several primary ways, each of which is valuable to internal auditors.

additional automated controlsManagement can use Sap Businessobjects process control to build new automated controls and replace manual controls. Internal auditors appreciate this because the process becomes not only more effi­cient but also more reliable. Instead of performing manual tests of manual controls, auditors test the rules in Sap Businessobjects process control and manage the resolution of issues.

Management can also use Sap Businessobjects process control to build new monitoring controls. these are controls that provide management with assurance that its policies, pro­cesses, and other controls are operat­ing as intended. auditors are able to rely on management’s monitoring con­trols and can test them to determine if they are operating as intended, instead of performing more extensive tests of the monitored controls.

automated testing of controlsauditors and others, such as financial compliance or internal control staff, can use Sap Businessobjects process control for automated testing of con­trols. this can be done on a continuous or as­needed basis. for example:• auditors can monitor changes to the

configuration of key automated con­trols, receiving notification if and when changes are made. this is a very effi cient way of testing auto mated con trols, replacing more expensive manual tests and eliminating the need to reperform the controls.

• auditors can monitor transactions against defined rules. this provides a level of assurance that the controls are performing as intended.

• fraud detection can be performed by monitoring transactions and by looking for indicators of fraud, such as a concentration of purchases from a single vendor.

• for some controls, auditors can use the management self­assessment (survey) function.

• repeated manual testing can be per formed using the adobe inter­active forms functionality of Sap Businessobjects process control. for example, Sap Businessobjects process control can select transac­tions for testing and route them with an audit program to the individuals designated to perform the testing.

other considerationsMany companies rely on internal audit to perform testing of controls over finan ­cial reporting for compliance with u.S. Sarbanes­oxley act or similar inter na­tional regulations. Sap Businessobjects process control is a good solution for this purpose, especially when the auto­mated control testing functionality is utilized.

Many internal audit departments cur­rently use products from companies that specialize in software for internal auditors for these purposes and for data analytics. their strengths include a significant level of content as well as active marketing and thought leader­ship. however, they rely on extracts from corporate systems (their solutions are effectively business intelligence for auditors) that may not be updated as the corporate systems are changed.

15SAP Thought Leadership – Internal audit requirements and Sap Solutions

they are generally not enterprise solu­tions supported by It. Because such products may be developed with com­plex programming languages, internal auditors often need to train specialized It audit staff to support them. Some customers that use such products have reported difficulties identifying the cor­rect data to analyze. By comparison, Sap solutions are integrated with enter­prise resource planning (erp) solutions from Sap and other vendors, so the data is generally more reliable (it is sub­ject to enterprise controls) and more readily understood.

the traditional internal audit approach is based on an annual plan, which may be updated during the year, with a num ber of individual audit projects.

Increasingly, internal auditors are turning to continuous auditing and continuous monitoring. (In theory, monitoring is performed by manage ment, but many auditors are developing the monitoring program with the intent to turn it over at a later date to management.) Sap Businessobjects process control is an excellent solution for both continuous auditing and continuous monitoring, especially when supplemented by Sap Businessobjects access control for the monitoring of systems access controls and by Sap Businessobjects BI solutions for complex data analysis.

It is important to understand that while internal auditors globally are exploring the potential for continuous auditing, few have made significant progress in

totally replacing traditional auditing methods. the great majority have a desire to start but are doing so slowly and carefully – the appropriate approach. for the next few years at least, custom­ers will use a combination of traditional auditing methods, which are supported by audit management functionality in Sap netWeaver, and continuous audit­ing and monitoring supported by Sap Businessobjects process control.

SAP BusinessObjects BI Solutions

Many internal auditors at customers where Sap Businessobjects BI solu­tions are installed are significantly under­utilizing the solutions. auditors may not be aware that the solutions are avail­able, or they may fail to appreciate their strength. they may be using products developed just for auditors that are not supported as enterprise applications. this represents an opportunity to broaden usage within the organization. See also the “Sap Businessobjects process control” section.

In the same way that operating man­agement can use Sap Businessobjects BI solutions to transform mountains of data into actionable intelligence, internal auditors can sift through that data to understand and monitor risks and to identify potential control issues or inappropriate activities.

16 SAP Thought Leadership – Internal audit requirements and Sap Solutions

Internal auditors should consider using a combination of Sap Businessobjects process control and Sap Businessobjects BI solutions for data analytics (often referred to as computer­assisted audit techniques).• Sap Businessobjects process

control monitors activities on a near real­time basis. this is a major advan­tage when it is critical to respond promptly to potential fraud or errors.

• Sap Businessobjects process control has workflow to manage identified exceptions and the actions taken to review them.

• Sap Businessobjects BI solutions can perform complex and sophisti­cated monitoring and testing of data and analyze millions of transactions without interfering with the perfor­mance of erp software.

Solution Combinations

each product has value in its own right and is often bought separately by cus­tomers. however, there are combina­tions of products that can provide enhanced value – whether acquired in the same purchase transaction or at a later date.• Sap Businessobjects risk Manage­

ment and audit management function­ality in Sap netWeaver: Internal audi­tors using a traditional audit approach can use Sap Businessobjects risk Management to identify the risks that need to be addressed and then build their audit plan using Sap netWeaver.

• Sap Businessobjects process con trol and audit management function ality in Sap netWeaver: Internal audi tors can develop the

audit program using audit manage­ment functionality in Sap netWeaver and perform the test using Sap Businessobjects process control. the results can be captured in adobe pdf format and uploaded into audit management func tionality as supporting working papers.

• Sap Businessobjects access con­trol and audit management func tion­ality in Sap netWeaver: In the same way that internal auditors can use Sap Businessobjects process con trol for performing audit tests, they can use reports from Sap Businessobjects access control to test system access. the results are uploaded into audit management functionality as working papers.

• Sap Businessobjects BI solutions and audit management functionality in Sap netWeaver: auditors can use Sap Businessobjects BI solutions to monitor risks (in the absence of a formal risk management program with current assessments) during the development of the audit plan in Sap netWeaver. Sap Businessobjects BI solutions can also be used, similarly to Sap Businessobjects process control, to perform data analytics as instructed in the audit program main­tained in audit management function­ality in Sap netWeaver.

the entire enterprise should implement risk management processes. Internal audit’s risk assessment should be derived from or integrated with those enterprise risk management processes. enterprises are supported by Sap Businessobjects risk Management, Sap Businessobjects BI solutions, and audit management functionality in Sap netWeaver.

17SAP Thought Leadership – Internal audit requirements and Sap Solutions

• Sap Businessobjects risk Manage­ment and Sap Businessobjects process control: this combination is excellent for continuous auditing and monitoring. Internal auditors can use Sap Businessobjects risk Manage ment to help ensure that the contin uous auditing and monitoring program remains focused on the more signifi cant risks as business conditions change.

• Sap Businessobjects process control and Sap Businessobjects access control: In a continuous auditing and monitoring program, it is necessary to monitor business controls and access to It systems. this combination allows internal auditors to do both.

• Sap Businessobjects process control and Sap Businessobjects BI solutions: as noted above in the

“Sap Businessobjects BI Solutions” section, internal auditors should consider using a combination of Sap Businessobjects process control and Sap Businessobjects BI solu­tions. together these solutions pro­vide strong data analytics and near real­time monitoring functionality.

for More Informationto find out more about how Sap solu tions can help, contact your Sap repre sentative or visit us at www.sap.com/solutions /businessobjects.

www.sap.com/contactsap

50 100 831 (10/07) ©2010 Sap aG. all rights reserved.

Sap, r/3, Sap netWeaver, duet, partneredge, Bydesign, Sap Businessobjects explorer, and other Sap products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of Sap aG in Germany and other countries.

Business objects and the Business objects logo, Businessobjects, crystal reports, crystal decisions, Web Intelligence, Xcelsius, and other Business objects products and services mentioned herein as well as their respective logos are trademarks or registered trade ­ marks of Business objects Software ltd. in the united States and in other countries.

all other product and service names mentioned are the trademarks of their respective companies. data contained in this document serves informational purposes only. national product specifications may vary.

these materials are subject to change without notice. these materials are provided by Sap aG and its affiliated companies (“Sap Group”) for informational purposes only, without representation or warranty of any kind, and Sap Group shall not be liable for errors or omissions with respect to the materials. the only warranties for Sap Group products and services are those that are set forth in the express warranty statements accompanying such products and services, if any. nothing herein should be construed as constituting an additional warranty.